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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE MONTH(S) FROM 

THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 
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1 )S Responsive to communication(s) filed on 10 May 2001 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 
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Application Papers 
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10)^ The drawing(s) filed on 1 1 December 2000 is/are: a)£3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121(d). 
11 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
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application from the International Bureau (PCT Rule 17.2(a)). 
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DETAILED ACTION 



Claims 1-25 have been examined. 



Claim Rejections - 35 USC § 103 



2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



3. Claims 1, 3, 5, 7, 9, 11, 13, 15, 17, 19,21,23 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Applicant's Admitted Prior Art (hereinafter AAPA) in view of Zubeldia 
et al. European Patent No. 0869637 (hereinafter Zubeldia) and further in view of Grimmer U.S. 
Pat. No. 5774552 (hereinafter Grimmer). 

4. As per claims 1, 5, 7, 9, 13, 15, 17, 21, and 23, AAPA discloses a method for authorizing 
access to controlled resources within a distributed data processing system, the method 
comprising: receiving an attribute certificate from a client at a host within the distributed data 
processing system (AAPA: page 1 line 15 - page 27); verifying the attribute certificate using the 
public key certificate of the issuing authority for the attribute certificate (AAPA: page 1 line 15 - 
page 27); and authorizing the client to have access to the controlled resources in accordance with 
authorization attributes stored in the attribute certificate (AAPA: page 1 line 15 - page 27). 
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AAPA does not explicitly disclose extracting a first locator from the attribute certificate, wherein 
the first locator identifies a location of a public key certificate of an issuing authority for the 
attribute certificate; retrieving the public key certificate of the issuing authority for the attribute 
certificate. However, Zubeldia discloses using certificate index to retrieve certificate information 
used for authentication from repository (Zubeldia: page 4 line33 - page 5 line 8). It would have 
been obvious to one having ordinary skill in the art to use the certificate index to retrieve 
information required for authenticating the digital certificate. Therefore, it would have been 
obvious to one having ordinary skill in the art to combine the teachings of Zubeldia within the 
system of AAPA because it allows more efficient and flexible digital certification by storing 
necessary information for authenticating the certificate in a central repository so that it is easy to 
change attributes in the certificate. 

AAPA as modified does not explicitly disclose the method of retrieving information/certificate 
and information/certificate stored in the repository that complies with X.509 standard. However, 
Grimmer discloses that limitation (Grimmer: column 4 lines 6-41 and column 5 line 54 - column 
8 lines 33: dynamic link library). It would have been to one having ordinary skill in the art to 
combine the teachings of Grimmer because it increases security by storing authentication 
certificate/information in a secure centralized repository. 

5. As per claim 3, 1 1, and 19, AAPA as modified discloses the method of claim 1. AAPA as 
modified further discloses wherein the attribute certificate and the public key certificate of the 
issuing authority for the attribute certificate are formatted according to the X.509 standard 
(AAPA: page 3 lines 9-18). 
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6. Claims 2 , 6, 8, 10, 14, 16, 18, 22, and 24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over AAPA in view of Zubeldia and further in view of Grimmer and further in view 
of Kent U.S. Pat. No. 6671804 (hereinafter Kent) and further in view of de Silva et al. U.S. Pat. 
No. 6615347 (hereinafter de Silva). 

7. As per claim 2, 6, 8, 10, 14, 16, 18, 22, and 24, AAPA as modified discloses the method 
of claim 1 and 5. AAPA as modified further discloses extracting user's certificate. AAPA as 
modified does not explicitly discloses the method comprising: extracting a second locator from 
the attribute certificate, wherein the second locator identifies a location of a public key certificate 
of a holder of the attribute certificate; retrieving the public key certificate of the holder of the 
attribute certificate; authenticating the holder using the public key certificate of the holder. 
However, Kent discloses the attribute certificate has a pointer that binds attribute certificate with 
the user's public key certificate (Kent: column 1 lines36-39). It would have been obvious to one 
having ordinary skill in the art to use the pointer to find the user's public key certificate in the 
repository. Therefore, it would have been obvious to one having ordinary skill in the art to 
combine the teachings of Kent within the combination of AAPA-Zubeldia-Grimmer because it is 
well known in the art. 

AAPA as modified does not explicitly discloses there are two locators stored in the digital 
certificates. However, de Silva discloses storing plurality of related certificates in the extension 
field of a certificate (de Silva: figure 3 and column 5 lines 15-41 and column 6 line 56 - column 
7 line 5). It would have been obvious to one having ordinary skill in the art to use the extension 
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field to include ED required to retrieve information for authentication. Therefore, it would have 
been obvious to one having ordinary skill in the art to combine the teachings of de Silva within 
the combination of AAPA-Zubeldia-Grimmer-Kent because it is well known in the art to 
associate plurality of related certificates to establish trust path if necessary. 

8. Claims 4, 12, and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
AAPA in view of Zubeldia and further in view of Grimmer and further in view of de Silva. 

9. As per claim 4, 12, and 20, AAPA as modified discloses the method of claim 1. 
However, AAPA as modified does not explicitly disclose wherein the first locator is stored 
within an X.509 extension within the attribute certificate. However, de Silva discloses the 
extension is used to store related certificates and serial numbers (de Silva: figure 2 and column 5 
lines 15-41 and column 6 line 56 - column 7 line 5). It would have been obvious to one having 
ordinary skill in the art to use the serial numbers stored in the extension to retrieve other 
certificates in repository. Therefore, it would have been obvious to one having ordinary skill in 
the art to combine the teachings of de Silva within the combination of AAPA-Zubeldia-Grimmer 
because it is well known in the art to store certificate information into the extension of a 
certificate including serial numbers. 

10. Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over Farrell et al. "An 
Internet Attribute Certificate Profile for Authentication" (hereinafter Farrell) in view of de Silva 
and further in view of Zubeldia. 
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11. As per claim 25, Farrell discloses a data structure representing an attribute certificate for 
use in a data processing system, the data structure comprising: 

an issuer name; a signature; a holder name; an attribute; and an extension (Farrell: page 8 section 
4.1). 

Farrell does not explicitly disclose wherein the extension comprises a locator identifying a 
location of a public key certificate of an issuing authority for the attribute certificate. However, 
de Silva discloses the extension discloses related certificate and serial number (de Silva: (de 
Silva: figure 2 and column 5 lines 15-41 and column 6 line 56 - column 7 line 5). It would have 
been obvious to one having ordinary skill in the art to combine the teachings of de Silvia within 
the system of Farrell because it allows additional information relating to the certificate to be used 
for authentication. 

Farrell as modified does not explicitly disclose that issuing authority certificate can be obtained 
through locator. However, Zubeldia discloses issuing authority certificate can be obtained from a 
certification repository and the repository is accessed through unique ID. (Zubeldia: abstract: 
location of the additional information is indicated by the unique ID; page 3 lines 44-48: obtain a 
copy of certificate through certificate repository). It would have been obvious to one having 
ordinary skill in the art to obtain required information through the use of pointers or indicators 
that retrieves the information in a directory or database. Therefore, it would have been obvious to 
one having ordinary skill to combine the teachings of Zubeldia within the combination of Farrell- 
de Silvia because using pointers or indicators to retrieve information in a database or directory is 
well known in the art. 
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Conclusion 



12. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Schell et al. U.S. Pat. No. 6615350 discloses certifying authority certificate and other 
certificates that may be used for binding structure include a set of standard information and the 
certifying authority certificate location can be a pointer or other data structure for accessing the 
certifying authority certificate (Schell: column 33 lines 10 - 65). 

Van Oorschot et al. U.S. Pat. No. 6134550 discloses shortest trusted path for 
authenticating digital certificate. 

Patel U.S. Pub. No. US20020004900 discloses method for secure anonymous 
communication. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shin-Hon Chen whose telephone number is (703) 305-8654. The 
examiner can normally be reached on Monday through Friday 8:00am to 4:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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